MGASA-2013-0320

Dashboard / Vulnerabilities / MGASA-2013-0320

MGASA-2013-0320

Summary: Updated firefox & related packages fix multiple security vulnerabilities

Details: Updated firefox packages fix security vulnerabilities: Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure (CVE-2013-1739). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to terminate unexpectedly or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2013-5590, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602). It was found that the Firefox JavaScript engine incorrectly allocated memory for certain functions. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox (CVE-2013-5595). A flaw was found in the way Firefox handled certain Extensible Stylesheet Language Transformations (XSLT) files. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox (CVE-2013-5604). Additionally, the rootcerts, nspr, nss, and sqlite3 packages have been updated to newer versions required by this update.

References: https://advisories.mageia.org/MGASA-2013-0320.html, http://www.mozilla.org/security/announce/2013/mfsa2013-93.html, http://www.mozilla.org/security/announce/2013/mfsa2013-95.html, http://www.mozilla.org/security/announce/2013/mfsa2013-96.html, http://www.mozilla.org/security/announce/2013/mfsa2013-98.html, http://www.mozilla.org/security/announce/2013/mfsa2013-100.html, http://www.mozilla.org/security/announce/2013/mfsa2013-101.html, http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html, http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:257/, https://rhn.redhat.com/errata/RHSA-2013-1476.html, https://bugs.mageia.org/show_bug.cgi?id=11370